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CLAIMS: 

1 . A method comprising: 

calculating traffic statistics associated with packet flows through a network; 
maintaining a heap that provides a heap-ordered representation of the packet flows; 
processing the heap to select one or more of the packet flows; and 
outputting the traffic statistics associated with the selected packet flows. 

2. The method of claim 1 , further comprising: 
receiving a query from a client; 

processing the heap in response to the query; and 

outputting the traffic statistics associated with the selected packets to the client. 

3 . The method of claim 1 , wherein processing the heap comprises: 
cloning the heap to produce a heap clone; and 

extracting one or more heap entries from the heap clone to select the packet flows. 

4. The method of claim 1 , wherein calculating traffic statistics and maintaining a heap 
are performed concurrently with processing the heap and outputting the traffic statistics. 

5. The method of claim 1 , wherein calculating traffic statistics comprises maintaining a 
flow table that stores traffic flow statistics for a set of packet flows. 

6. The method of claim 1, wherein maintaining a heap comprises maintaining a table 
representation of the heap. 

7. The method of claim 6, wherein maintaining the heap comprises storing packet flow 
identifiers as elements of the table and in a heap-ordered fashion. 
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8. The method of claim 1 , further comprising identifying the packet flows by at least 
one of a source network address, a destination network address, a protocol, a source port 
number, and a destination port number. 

9. The method of claim 1 , wherein calculating traffic statistics comprises: 
receiving a packet from a network via an interface card of a network device; and 
extracting a key from the packet; 

associating the packet with one of the packet flows based on the key; and 
updating the flow statistics for the associated packet flow based on contents of the 

packet. 

1 0. The method of claim 9, wherein maintaining a heap comprises performing a heapify 
operation on the heap after receiving the packet and updating the flow statistics. 

11. The method of claim 1 , wherein calculating traffic statistics further comprises 
communicating the packets to an accounting service card of a network device, wherein the 
accounting service card calculates the traffic statistics. 

12. The method of claim 1 , further comprising: 

receiving a query from a network client, wherein the query requests M ordered packet 

flows; 

cloning the heap to produce a heap clone in response to the query 
performing M-l heapify operations to extract the M ordered packet flow identifiers 
from the heap; and 

outputting the traffic statistics associated with the M packet flow identifiers. 

13. A method comprising: 

maintaining a heap that provides a heap-ordered representation of packet flows within 
a network based on at least one criteria associated with the packet flows; and 

processing the heap to output traffic statistics associated with an ordered subset of the 
packet flows. 



19 



Docket No.: 1014-068US01 /JNP-0312 



14. The method of claim 13, wherein the criteria comprises one of a byte count and a 
packet count associated with each of the packet flows. 

15. The method of claim 13, wherein processing the heap comprises: 
receiving a query from a network client; 

cloning the heap to produce a heap clone; 

extracting one or more heap entries from the heap clone to extract identifiers for the 
ordered subset of the packet flows; and 

outputting the traffic statistics associated with the extracted identifiers. 

1 6. The method of claim 13, wherein maintaining a heap is performed concurrently with 
processing the heap. 

17. A method comprising: 

maintaining a data structure that stores N packet flow identifiers for packet flows 

within a network; 

receiving a query from a network client, wherein the query requests traffic flow 
statistics for M packet flows selected from the N packet flows based on an ordered 
relationship to a criteria; 

applying an algorithm to process the data structure to identify the M packet flows in a 
computational time that can be represented as less than or equal to 0(Mlog(N)); and 

outputting the traffic statistics associated with the M packet flows. 

18. The method of claim 1 7, wherein the criteria comprises one of a byte count and a 
packet count associated with each of the packet flows. 

19. The method of claim 17, wherein the data structure comprises a heap that provides a 
heap-ordered representation of the packet flows. 
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20. The method of claim 19, wherein applying an algorithm comprises: 
cloning the heap to produce a heap clone; 

extracting one or more heap entries from the heap clone to extract packet flow 
identifiers for the M packet flows; and 

outputting the traffic statistics associated with the extracted identifiers. 

21. A computer-readable medium comprising instructions for causing a programmable 
processor to: 

calculate traffic statistics associated with packet flows through a network; 
maintain a heap that provides a heap-ordered representation of the packet flows; 
process the heap to select one or more of the packet flows; and 
output the traffic statistics associated with the selected packet flows. 

22 . The computer-readable medium of claim 2 1 , further comprising instructions to cause 
the processor to: 

receive a query from a network client; 
process the heap in response to the query; and 

output the traffic statistics associated with the selected packets to the network client. 

23 . The computer-readable medium of claim 2 1 , wherein the instructions cause the 
processor to: 

clone the heap to produce a heap clone; and 

extract one or more heap entries from the heap clone to select the packet flows. 

24. The computer-readable medium of claim 21, wherein the instructions cause the 
processor to perform calculating traffic statistics and maintaining a heap concurrently with 
processing the heap and outputting the traffic statistics. 

25 . The computer-readable medium of claim 2 1 , wherein the instructions cause the 
processor to maintain a flow table that stores traffic flow statistics for a set of packet flows. 
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26. The computer-readable medium of claim 2 1 , wherein the instructions cause the 
processor to maintain a table representation of the heap. 

27. The computer-readable medium of claim 21 , wherein the instructions cause the 
processor to store packet flow identifiers with the heap in a heap-ordered fashion. 

28. Network elements comprising: 

an interface to receive packets flows from a network; and 

a control unit coupled to the interface, wherein the control unit computes flow 

statistics for the packets, and maintains identifiers for the packet flows in a heap-ordered 

representation based on at least one of the statistics. 

29. The network elements of claim 28, wherein the control unit maintains the identifiers 
as a heap having a plurality of entries, wherein each entry stores a respective identifier for 
one of the packet flows. 

30. The network elements of claim 29, further comprising a user interface to receive a 
query from a client, wherein the control unit processes the heap in response to the query to 
select one or more of the identifiers, and the user interface outputs a portion of the traffic 
statistics associated with the selected identifiers. 

3 1 The network elements of claim 29, wherein the control unit clones the heap to 
produce a heap clone, and processes the heap clone to extracting the identifiers. 

32. The network elements of claim 29, wherein the control unit concurrently computes 
the flow statistics and maintains the identifiers concurrently with processing the heap and 
outputting the portion of the traffic statistics. 

33. The network elements of claim 29, wherein the control unit associates the packets 
with the packet flows by determining for each packet at least one of a source network 
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address, a destination network address, a protocol, a source port number, and a destination 
port number. 

34. The network elements of claim 28, wherein the control unit calculates the flow 
statistics and maintains the heap-ordered representation in real-time as packets are received 
from the interface card. 

35. The network elements of claim 28, wherein the control unit comprises an accounting 
module that calculates the traffic statistics. 

36. The network elements of claim 28, further comprising an accounting service card, 
wherein the control unit forwards the packets to the accounting service card to calculate the 
traffic statistics. 

37. The network elements of claim 28, wherein the control unit comprises: 

a routing engine to maintain routing information representing a topology of the 
network; and 

a forwarding engine to forward the network packets in accordance with the routing 
information. 

38. The network elements of claim 28, wherein the network device comprises one of a 
router, a switch, a gateway, and a hub. 

39. A network device comprising: 

an interface to receive packets flows from a network; 
a control unit coupled to the interface; and 

an accounting service card, wherein the control unit forwards the packets to the 
accounting service card to calculate the traffic statistics, wherein the accounting service card 
computes flow statistics for the packets, and maintains maintaining a heap that provides a 
heap-ordered representation of the packet flows. 
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The network device of claim 39, wherein the accounting service card comprises: 
a flow table to store the flow statistics; and 
a heap table to store the heap. 
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